📈 economics

Reserve Depletion and Security Runway in Proof-of-Stake Systems

This paper presents a stochastic equilibrium framework to derive state-dependent reserve thresholds that determine whether a Proof-of-Stake system can sustain its security level through a finite token reserve until transaction fees alone become sufficient, thereby enabling rigorous stress-testing of the transition from reserve-dependent to fee-only security.

Original authors: Paolo Penna, Manvir Schneider

Published 2026-06-03

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Paolo Penna, Manvir Schneider

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a Proof-of-Stake blockchain as a high-security fortress that needs a constant army of guards (validators) to keep it safe from attackers. These guards need to be paid to stay on duty.

In the beginning, the fortress is new and empty. There aren't many people visiting, so the "entrance fees" (transaction fees) collected from visitors are too small to pay the guards a living wage. If the guards aren't paid, they leave, the fortress becomes unguarded, and the system collapses.

To solve this, the fortress has a giant emergency savings account (the Reserve) filled with tokens. This account is meant to subsidize the guards' wages until the fortress becomes popular enough that entrance fees alone can cover the costs.

The paper by Penna and Schneider asks a critical question: Will this savings account last long enough to bridge the gap until the entrance fees are high enough?

Here is the breakdown of their findings using simple analogies:

1. The "Purchasing Power" Trap

The paper points out a tricky problem: The savings account is filled with tokens, but the guards need to pay their bills in real-world money (like dollars).

The Metaphor: Imagine your savings account is full of gold coins. If the price of gold drops, your account might look huge in terms of coin count, but you can't buy as much bread with it.
The Insight: A protocol might look "safe" because it has a billion tokens in reserve. But if the token price crashes, that billion tokens might not be enough to pay the guards for even one day. The paper argues you can't just look at the number of tokens; you have to look at their value at that specific moment.

2. The "Safety Line" (The Threshold)

The authors created a mathematical "Safety Line" that moves around like a tide.

The Metaphor: Imagine a boat (the Reserve) trying to cross a river to reach a safe island (Fee-Only Security). The water level (Token Price and Demand) is constantly rising and falling.
The Rule: The boat doesn't sink just because it runs out of fuel (tokens). It sinks if the water gets too low relative to the boat's current weight.
The Three Zones:
1. The Danger Zone: The demand is so low that even with a massive savings account, you can't pay the guards enough. The system is doomed no matter what.
2. The Bridge Zone: The demand is okay, but you still need the savings account to top up the guards' pay. As long as the savings account stays above the "Safety Line," the fortress is secure.
3. The Safe Island: The entrance fees are now so high that you don't need the savings account anymore. The system is self-sustaining.

3. The "Runway" Concept

The paper introduces the idea of a "Security Runway."

The Metaphor: Think of a plane taking off. It needs a long runway to gain speed before it can fly on its own.
The Insight: The "runway" isn't just about how much fuel (tokens) is left. It's about whether the plane has enough speed (demand) to fly before it runs out of fuel.
The Failure Point: The system fails not when the tank is empty, but the moment the tank dips below the specific amount needed to keep the plane flying at the current speed. If the wind (demand) dies down suddenly, the runway shortens, and the plane might crash even if it still has fuel.

4. The "Crystal Ball" Problem (Forward-Looking Guards)

The paper also considers what happens if the guards are smart enough to look into the future.

The Metaphor: If a guard thinks, "Hey, if I work a little harder today, the savings account will grow, and I'll get paid more next year," they might work harder now.
The Insight: The authors show that even if guards are thinking about the future, the core rule remains: You still need to stay above that moving "Safety Line." However, if the guards know the future looks good, they might be willing to work for slightly less today, which changes the math slightly but doesn't change the fundamental risk.

5. Stress-Testing the System

The authors provide a way to "stress-test" the fortress before it even opens.

The Method: Instead of guessing, you can calculate: "If the token price drops by 20% and demand drops by 10% for the next 5 years, will our savings account still be above the Safety Line?"
The Result: This gives a concrete "Yes/No" answer. If the answer is "No," the protocol needs more initial funding or a different plan, regardless of how optimistic the current market looks.

The Bottom Line

The main takeaway is that a big pile of tokens does not equal safety.

A protocol can have a massive reserve and still fail if the token price crashes or if people stop using the network. Conversely, a protocol with a smaller reserve can be perfectly safe if the network is so popular that fees alone can pay the guards.

To keep a blockchain secure, you shouldn't just count the coins in the vault; you have to constantly check if the value of those coins combined with current user demand is enough to keep the guards happy and the fortress secure until the system can stand on its own.

Technical Summary: Reserve Depletion and Security Runway in Proof-of-Stake Systems

Problem Statement
Proof-of-Stake (PoS) blockchains often rely on a dual funding mechanism for validator rewards: transaction fees and a finite reserve of native tokens. This design creates a "dynamic hand-off" problem. In the early stages of a protocol, transaction fees are typically insufficient to fund the target level of security (active stake), necessitating subsidies from the reserve. As adoption grows, fees are expected to become sufficient to sustain security independently.

The central challenge is determining whether the reserve provides a sufficient "runway" to maintain security throughout this transition. The paper identifies two sources of fragility:

Demand Uncertainty: Transaction fee income is stochastic, dependent on user demand for blockspace.
Price Risk: The reserve is held in native tokens, while validator costs are incurred in an external numeraire. A reserve that appears ample in token units may become inadequate following a token price drawdown.

Governance cannot rely solely on nominal reserve balances or steady-state reward ratios. A protocol with a large nominal reserve may face imminent security failure if price or demand shocks occur, while a protocol with a shrinking reserve may be secure if fees have already crossed the threshold for self-sufficiency. The paper seeks to formalize the conditions under which a protocol can guarantee secure operation during this transition and define when the transition fails.

Methodology
The authors construct a discrete-time stochastic model involving $N$ strategic validators.

State Variables: The system state $X_t = (R_t, \text{Price}_t, \text{FeeMax}_t)$ consists of the reserve stock ( $R_t$ ), the token price in an external numeraire ( $\text{Price}_t$ ), and a demand shifter representing the maximum fee users are willing to pay ( $\text{FeeMax}_t$ ).
Validator Behavior: Validators choose participation levels (active stake) to maximize utility, balancing rewards (fees + reserve payouts) against quadratic operating costs.
Equilibrium Concept: The analysis begins with a static stage-game to derive a symmetric Nash equilibrium for validator participation. It then extends to a dynamic setting where the reserve evolves based on fee revenue and payouts.
Forward-Looking Extension: The model is extended to a finite-horizon Markov game where validators are forward-looking, considering how current participation affects future reserve stocks and continuation values.
Stochastic Dynamics: For quantitative analysis, the model specializes to geometric Brownian motion for token prices and discrete-time lognormal dynamics for demand.

Key Contributions and Results

Closed-Form Static Equilibrium:
The paper solves the validator participation game in closed form (Theorem 3), proving the existence and uniqueness of a symmetric Nash equilibrium. The equilibrium aggregate security level $s^*$ is shown to depend on the product of the token price and the reserve stock ( $\text{Price} \cdot R$ ), highlighting that the security value of a fixed reserve amount is state-dependent.
State-Dependent Reserve Threshold:
The core theoretical contribution is the derivation of an exact, state-dependent reserve threshold, denoted $\text{SecureR}(\text{Price}, \text{FeeMax}; s)$ (Theorem 10). For any target security level $s$ , this threshold represents the minimal reserve stock required to sustain that security level given the current price and demand.
- Three Regions: This threshold partitions the state space into:
  1. Infeasibility: Demand is too low to support the target security level even with infinite reserves.
  2. Reserve-Dependent Security: The target is achievable only if the reserve exceeds the threshold.
  3. Fee-Only Security: Demand is high enough that the threshold is zero; the reserve is redundant for security.
Dynamic Hand-Off as a Hitting-Time Problem:
The transition from reserve-funded to fee-only security is formalized as a hitting-time problem (Proposition 13).
- Failure Time ( $\tau_{\text{fail}}$ ): The first time the reserve falls below the state-dependent threshold.
- Hand-Off Time ( $\tau_{\text{hand}}$ ): The first time the system enters the fee-only region (threshold becomes zero).
- Success Condition: A successful hand-off occurs if and only if $\tau_{\text{hand}} < \tau_{\text{fail}}$ .
Stress-Test Guarantees:
The authors derive conservative finite-horizon stress-test guarantees (Theorem 15). By using lower confidence bands for price and demand, one can calculate a deterministic reserve requirement that ensures security with a specified probability, ignoring future fee inflows to remain conservative. Under lognormal dynamics, explicit bounds on failure probabilities and expected hand-off times are provided (Theorem 30, Proposition 31).
Forward-Looking Validators:
In the Markov extension, the paper proves the existence of a Markov Perfect Equilibrium (Theorem 22) and derives the dynamic first-order condition (Proposition 25). This condition captures how current participation affects future reserve accumulation. The results show that while forward-looking incentives modify the equilibrium security level, the fundamental "runway" logic (security depends on the reserve being above a state-dependent cutoff) persists (Proposition 27).

Significance and Claims
The paper claims to provide the first tractable equilibrium framework specifically isolating the "reserve hand-off" problem in PoS systems. Its primary significance lies in shifting the evaluation of reserve adequacy from static metrics (e.g., "years of runway" based on current burn rates) to a state-dependent runway analysis.

The authors argue that:

Reserves are not neutral: Their security value fluctuates with token price and demand. A large nominal reserve does not guarantee security against adverse shocks.
Thresholds are critical: Governance should monitor the state-dependent threshold rather than just the reserve balance. Once demand crosses the fee-only threshold, the reserve becomes redundant for security purposes.
Policy Implications: Reserve policy should not be evaluated by nominal depletion dates alone. The framework allows for "stress-testing" the transition path state-by-state, converting reserve adequacy into a probabilistic hitting-time problem.

The paper concludes by noting that while the current model assumes fixed policy parameters ( $\theta$ and $\rho$ ), future work could explore adaptive reserve policies where these parameters respond dynamically to the state variables to extend the runway or reduce failure risk.